| << Back to previous view |
|
[QB-4246] Users can trigger builds via promotion without proper permissions
|
|
| Status: | Open |
| Project: | QuickBuild |
| Component/s: | None |
| Affects Version/s: | 16.0.0 |
| Fix Version/s: | None |
| Type: | Bug | Priority: | Major |
| Reporter: | Nguyen Danh Hung | Assigned To: | Robin Shen |
| Resolution: | Unresolved | Votes: | 0 |
| Remaining Estimate: | Unknown | Time Spent: | Unknown |
| Original Estimate: | Unknown | ||
| Description |
|
Hello Mr. Robin Shen,
There is an issue when user can trigger build without RUN_BUILD permission: - 2 configurations: CONF_1, CONF_2 - User only has PROMOTE_BUILD permisison in CONF_1 - User used rest api to request build in CONF_2: + Case 1 - Without promotionSource in xml: Build cannot start + Case 2 - With promotionSource includes a buildId in CONF_1 in xml: A build started in CONF_2 Please help to investigata case 2 |